SentinelOne Wayfinder Threat Detection and Response Reviews

We have been using SentinelOne Singularity MDR for threat hunting and correlation, particularly when we identify if some kind of IOCs has been detected or if processes are found malicious. We then analyze it across the entire network for similar behaviors in other systems or processes. Accordingly, we curate responses, which can involve isolating those systems or conducting further investigation through back-end analysis, digging into command line consoles, or deleting files. This is the primary use case I can think of.

When discussing features in SentinelOne Singularity MDR, I find integration with third-party solutions and APIs very valuable because it eases management and response processes. With a robust library, it is easier to manage integrations with other technologies, such as the Check Point sandboxes, which we have found very useful.

In terms of minimizing false positives and delivering accurate detections, I have observed that the false positive rate in SentinelOne Singularity MDR is considerably lower compared to other solutions we have evaluated, thanks to the exceptions or policy changes that allow modifications to baseline policies hardcoded within the solution.

Regarding threat hunting capabilities, I assess that the threat hunting capability in SentinelOne Singularity MDR is quite good because their EDR collects extensive telemetry data, and the backend search engine processes this data quickly. This speed is crucial for our large-level customers who have around 50,000 inputs and multiple gigabytes of data daily. Therefore, threat hunting becomes easier due to the significant amount of telemetry data gathered and the fast processing time when firing queries.

The main benefits that clients receive from SentinelOne Singularity MDR, from an operational perspective, include ease of deployment, where the installation process across various operating systems and different hardware configurations goes smoothly with minimal impact on end users. It is important that end users have a smooth experience during deployment. Besides the navigation issue I mentioned, policy configurations and other processes are straightforward, similar to a plug-and-play setup that is easy to manage. Furthermore, the detection rate is very good compared to other solutions, and as previously mentioned, the false positive rate is low, making the workload for the SOC team much easier after implementing SentinelOne Singularity MDR at our customers.

I would like to improve the dashboard in SentinelOne Singularity MDR, as it could be much better, along with the reporting structure. The granularity of policies and ease of policy management from the console could be made better, while my experience from a feature standpoint has been good overall.

Regarding summary reports provided from SentinelOne Singularity MDR, I find the reporting structure could be much better in terms of granularity. Additionally, for C-suite executives, there can be more non-technical content that provides a bird's eye view of organizational risk posture, rather than just detailed technical analyses. This high-level perspective on the organization's risk would be highly beneficial at the management level.

I have been with SentinelOne Singularity MDR since around December 2020, so it has been one and a half years.

The initial setup for SentinelOne Singularity MDR is simple; there are not many complexities involved unless you encounter unsupported third-party integrations, which can introduce some challenges. However, if you are using compatible data sources, the setup process is generally smooth.

The stability of SentinelOne Singularity MDR deserves a rating of eight.

The scalability rates at nine because they are quite scalable; being a cloud solution means we do not have to worry about scalability issues.

The technical support from SentinelOne Singularity MDR rates at 7.5 out of 10.

The initial setup for SentinelOne Singularity MDR is simple; there are not many complexities involved unless you encounter unsupported third-party integrations, which can introduce some challenges. However, if you are using compatible data sources, the setup process is generally smooth.

I can compare SentinelOne Singularity MDR to CrowdStrike as the main competitor in the market.

When comparing the two vendors, I feel that neither one is clearly better than the other, as both provide their own strong points and necessary features as part of their MDR solutions. Although I have not found significant differences, I do perceive that CrowdStrike has a slight edge regarding support and turnaround time for issue resolution, and they tend to introduce new features more regularly than SentinelOne Singularity MDR.

We currently work with multiple vendors since I work for a cybersecurity solution company, and in the EDR space, we are engaged with CrowdStrike and SentinelOne Singularity MDR.

We work with SentinelOne Singularity MDR as it is similar to SentinelOne Vigilance, and I specifically use Singularity only. I use every module of SentinelOne Singularity MDR, including EDR, NGAV, ASM, and Identity.

I have not specifically worked on the solution's proactivity and branch readiness features to state how they help in preparing for incidents. I have not encountered any use case that has not been covered by SentinelOne Singularity MDR, but since I have not explored the entire range of products they offer and they introduce new features quarterly, I cannot provide specific suggestions at this time.

Pricing for SentinelOne Singularity MDR varies on a case-by-case basis, and I notice that they have flexibility when it comes to pricing. On a scale where one is high and ten is low, I would place it around six.

My overall rating for SentinelOne Singularity MDR is 8 out of 10.

I deal with the MDR.

Some of the most valuable features of the SentinelOne Singularity MDR are its capabilities, and there are areas they can develop further.

My experience with the ability of SentinelOne Singularity MDR to minimize false positives and deliver actionable reports is positive, and I am speaking about SentinelOne Singularity MDR's support for that.

The impact of the threat hunting capabilities on detecting known and emerging threats in real-time is notable, and with the AI, it helps for real-time threat hunting. Their proactive breach readiness features have helped in preparing my team for incidents, and we have dealt with some of the proactive breach readiness features.

I assess the effectiveness of the managed detection and response services in protecting my organization as significant, especially since we did not use an MDR before and just relied on antivirus tools.

I have experience with the Singularity's ability to integrate with third-party services, and my impression is that it does a decent job.

The approximate reduction of the time to respond to incidents has been considerably improved, and it has really helped to reduce that time. We utilize the monthly summary reports provided by their MDR team.

I don't have any concerns about the setup process. It was pretty simple to do aside from setting up site locations within the admin portal, and it took just myself to deploy it. I was the only one involved in the deployment process.

I don't have any comments on the service's ability to provide incident reports and detailed investigation notes and recommendations, although some of my team might.

I rate their support very good, and their threat detection capability positively influences our security operations.

Positive

When we were deciding on SentinelOne Singularity MDR, we evaluated other options. There was a short list of solutions we were comparing it to, and there are clear differences between Field Effect and SentinelOne Singularity MDR.

The initial setup was straightforward and not complex to set up.

The pricing, setup costs, and licensing are similar in price to Field Effect.

The integration with Microsoft 365 for SentinelOne Singularity MDR isn't quite as effective as with Field Effect.

I have experience with SentinelOne Singularity MDR and other MDR solutions, and I would be willing to provide a review for one of the products that I'm familiar with.

We are not utilizing the DFIR, digital forensics and incident response, feature.

I don't have a comment on the hands-on coverage by global MDR analysts.

On a scale of 1-10, I rate SentinelOne Singularity MDR a 10.

We are using SentinelOne Wayfinder Threat Detection and Response ourselves.

Valuable features in SentinelOne Wayfinder Threat Detection and Response are satisfactory, and compared to other solutions, we feel this is appropriate for our current needs.

Using SentinelOne Wayfinder Threat Detection and Response has contributed to our team's focus on strategic initiatives as we are focusing more on deep visibility plus the threats on the endpoint and the device controller, which are all things we are monitoring.

We have been working in this field with SentinelOne Wayfinder Threat Detection and Response for the last two years.

Overall, the product has been stable.

I think their technical support has some problems with scanning on the Linux machine, but other than that, everything is fine.

I would rate their technical support as adequate, but the problem is they are indicating there is some back-end bug that has not been fixed yet; they are checking, but they are not fixing the problem.

The initial setup for SentinelOne Wayfinder Threat Detection and Response was straightforward.

We completed the setup with the help of a reseller.

My impression of the annotation and insights provided by SentinelOne Wayfinder Threat Detection and Response analysts on detected threats is that detection will happen based on whatever the engine is, but I am not certain about the specifics.

The integration process of SentinelOne Wayfinder Threat Detection and Response with our other security products was straightforward, and they helped us with queries for some policies.

We integrated SentinelOne Wayfinder Threat Detection and Response with log forwarding, some internal tools, and applications.

Speaking about the use cases for SentinelOne Vigilance, people are usually using these products for protecting their PCs to have a clean environment.

From my reseller and partner perspective, the best features in the products are easy deployment, really small size installation, and an update process. It is a Gartner leader, so there is a lot of innovation in it.

Regarding real-time monitoring features, it is absolutely accurate and automatically handled in most cases if configured correctly.

I am actually able to synthesize machine learning with human experience to manage complex threats in IRs. This is included as part of the back-office strategy that they run through an AI process.

I assess the importance of having 24/7 security coverage provided by SentinelOne Vigilance to be highly needed.

As a customer, I have seen benefits from using it, and I can assure that it is 100% protected against many threats, and it is always in the actual state.

I have observed improvements in Incident Response speeds since integrating SentinelOne Vigilance, as there are far more incidents automatically detected and cleared than before.

Regarding disadvantages of SentinelOne Vigilance, there is no local hub server that I can use to download the updates and signatures only once.

The solution is fully scalable, although the only point for scalability is that if there was local hub support, I could save some data transmission, but otherwise, it is fully capable.

Currently, the lack of a local hub is the only concern that I have faced. I do not have any other issues with the product.

I have been dealing with SentinelOne Vigilance for about a year now. We started testing approximately a year ago.

I find it absolutely stable. I do not have any issues there, and we had it on other systems before, but not on that one.

I would rate the actual technical support from SentinelOne Vigilance a nine.

Positive

In comparison to SentinelOne Vigilance, I was also dealing with Kaspersky.

The deployment is quite easy. If I have the right deployment tools, it is absolutely easy and self-handled.

I have seen some ROI, and my clients are fully satisfied compared with others, especially as it is a subscription on a monthly range, so I can adapt it to my users at any time.

For the overall return on investment, both time and money, I would say it is a full 20.

The pricing, licensing, and setup costs in general are quite affordable.

I am dealing with the complete suite, including the full package of SentinelOne Vigilance, Singularity Identity, and similar products.

The products I mentioned for MDR, for example, ITDR, such as Vigilance, Singularity Identity, I am also dealing with them to some extent.

I am a customer and an integrator partner. I do reselling as through my own direct clients that I support, not on the broad markets.

The specific reason for using it is because of all the handling and the automatic process. There is a lot of automatization, and if configured correctly, you do not need to care about that function.

I would rate SentinelOne Vigilance a nine out of ten.

I am both a reseller and integrator for the products, and my email is becker@medatech.de. I am the managing director.

I can confirm that if SentinelOne Vigilance has any questions or comments regarding my review, they can reach me via email to clarify something. I am interested in being a reference for this vendor.

The solution helps to protect our laptops and servers. 

We use a third-party tool linked to SentinelOne Vigilance for endpoint detection and response, which a cybersecurity center manages. The tool allows them to monitor all activity and control settings for us.

The best feature of this solution is the third-party management aspect. An external company oversees the tool's management and monitors the data it generates. If the EDR detects suspicious activity, it will react accordingly and take necessary actions, such as blocking a device.

After experiencing a breach in 2020 where our data was encrypted by ransomware, we decided to investigate and implement SentinelOne Vigilance. Since then, it has helped keep our business secure.

In security and event management, the tool collects data from all our log files and utilizes AI to detect suspicious activity.

I suspect that the areas for improvement may not necessarily lie within the tool itself but rather in our organization's lack of knowledge and understanding of cybersecurity. Cybersecurity is a complex area, and our organization has a skill set deficit. Therefore, we rely on our cybersecurity support company to help us manage the tool and handle incidents. Our limited expertise sometimes prevents us from fully utilizing them or identifying potential gaps.

I have been working with the product for three years. 

I haven't encountered any issues with the solution's stability. 

You can scale up as the company grows by adding new licenses. It's similar to other platforms like CrowdStrike and Palo Alto, where you can purchase additional licenses as needed when the number of devices or users increases.

We haven't directly contacted SentinelOne Vigilance's technical support. We go through the third party, who works directly with them. We have access to 24/7 support. We're quite satisfied with the level of support we receive. While you could potentially pay for more support, this is true for most products in this category.

The tool's deployment is straightforward and took a few days to complete. 

The tool's pricing is slightly cheaper than other alternatives. It's not just about licensing costs; because we already have it implemented, we can save money on deployment and initial setup. Additionally, SentinelOne Vigilance is slightly cheaper in licensing, maybe around 10-15 percent cheaper.

We did consider other options such as CrowdStrike and Palo Alto EDR. However, after evaluating all options, we found that SentinelOne Vigilance was the most cost-effective solution for us.

I rate the overall product a nine out of ten. 

We are based in India, and we need to have these resources. We use it with smaller teams on security, leveraging expertise from SentinelOne.

The most valuable functions are automated pricing and ensuring the console is clean. 

Additionally, it helps complete RC tasks and get the right information on the right app.

They've been adding a lot of products and technologies to their stack. I honestly don't have any specific improvements to suggest.

I have been using it for two years now.

From a stability perspective, I would rate it a nine or ten out of ten.

In terms of scalability, it's very high. I would give it a rating of nine or ten out of ten.

The support response time is not the issue, however, sometimes, the answers provided are not fully satisfactory due to the nature of the technology and issue complexity.

Positive

The initial setup was quite simple. We did not require any external consultants.

No consultants were required for the setup; our team handled it in-house.

Price could be a factor since, with a lot of add-ons, the cost becomes high.

I've evaluated Vigilance, which is comparable to CrowdStrike.

Overall, I would rate SentinelOne Vigilance a nine out of ten. It has given us peace of mind, and people using SentinelOne are generally satisfied, not switching to other solutions like CrowdStrike.

Our company uses the solution instead of a traditional antivirus as an endpoint protector. We have all security alerts passed off to a SOC. 

We are a football club and have 350 users across coaches, medical staff, and ticketing agents. 

The solution is very easy to use. 

The solution should add endpoint clients for mobile and Linux devices because it currently doesn't support them. 

We currently have to use an alternative product for mobile devices but would prefer to use one product for physical PCs, servers, and all mobile devices such as phones and iPads. 

I have been using the solution for two years. 

The solution is stable so stability is rated an eight out of ten.

The only time we had an issue was when two antiviruses were installed on the same machines and they were fighting against each other. 

The solution is scalable and there are multiple aspects to it. 

You can buy different types of licenses that give you more functions or functionality to the product set. Their new product is called Singularity and it includes XDR functionality. 

The scalability is rated an eight out of ten. 

I contacted technical support once and they were quick to respond. Technical support is rated a seven out of ten. 

Neutral

We previously used McAfee but found it to be a bit out of date. It didn't really fit our business requirements anymore. 

The setup is fairly straightforward because the solution is just an agent with a normal installation program. Installing agents on-premises only takes a couple of minutes. After that, you just connect to the cloud. 

We implement the solution in-house. Ongoing maintenance can be completed by one person in IT support. 

We can't really say there is an ROI because we don't have metrics to show that. Other football teams have been breached and we have not so that speaks well for the solution. 

The licensing cost depends on the number of connected devices and whether you purchase any additional services that are offered. 

The solution could be inexpensive for a small business but expensive for a large business because it is priced per device. 

We evaluated the solution, CrowdStrike, and Carbon Black. 

The solution does what it says it will do on the box. It all depends on how deep you want to go or which license you decide to purchase. 

I recommend the solution and rate it an eight out of ten. 

My company uses SentinelOne Vigilance as an endpoint security for our computers, so all the systems in our firm use SentinelOne to monitor malware.

When SentinelOne Vigilance's users go to websites that may be compromised or get attachments in emails that they click on by mistake, thinking they are legitimate, SentinelOne blocks them. SentinelOne Vigilance will alert both the user and me, the administrator, that some suspicious activity was blocked or quarantined. SentinelOne Vigilance has improved the security of our firm.

The most valuable feature of the solution is that it has a low profile on each machine, so it doesn't take up a lot of resources. The administrative functionality alerts the user and admin team if something has occurred in the systems. SentinelOne Vigilance's portal is easy enough for me to go in and address and get details of those threats.

I am not sure if there are a lot of improvements needed in the solution since my company is very pleased with the solution. SentinelOne Vigilance doesn't actively monitor incoming emails or offer an email plugin for Outlook. It would be fantastic if the solution could actively monitor incoming emails or offer an email plugin for Outlook. I don't say the aforementioned details as a downside of the product, but as an additional feature that might be very useful.

I have been using SentinelOne Vigilance for four years.

Stability-wise, I rate the solution a ten out of ten.

Scalability-wise, I rate the solution a ten out of ten.

I can't remember the last time I had to contact the solution's technical support. I would give the technical support a high rating.

The initial deployment of the solution was very straightforward.

The solution is deployed on the cloud.

I have seen a return on investment with the use of SentinelOne Vigilance in my company.

I rate the product's pricing an eight out of ten since it is really expensive, but it is well worth what my company gets.

SentinelOne Vigilance is a well-grounded solution that has minimal impact on an organization in negative ways and does a great job in the background of protecting our systems.

I rate the overall solution a ten out of ten.

In our company, we use SentinelOne Vigilance for security purposes. We not only use it to detect viruses but also to monitor any activities on the endpoints so that we can take appropriate measures to mitigate any potential threats.

Analytics is the most valuable feature of the solution. In our company, we use it for analytics, and then we use it for sharing certain details with our management, like informing them of the type of vulnerabilities detected by our team.

The price of the solution is very high. So, pricing is an area in the solution that needs improvement. Currently, SentinelOne Vigilance has a competitor named Trellix. Sometimes, SentinelOne Vigilance also detects false positives, which are not true. In such cases, we need to make changes in the policies on the dashboard accordingly.

I have been using SentinelOne Vigilance for three to four years. I am just a customer using the solution.

Stability-wise, I rate the solution a nine out of ten.

Scalability-wise, I rate the solution a nine out of ten.

Regarding the number of users using the solution, I would say that we have deployed the solution across our organization since ours is a shipping company. So, more than a thousand people are using the solution.

The solution's technical support team is good. The environment constantly changes due to the rise in cyber threats. I rate the technical support a nine out of ten. The technical support team will have to improve in a better way to deal with the emerging cyber threats in the market.

Positive

Previously, we were using a signature-based solution named Trend Micro

The initial setup was quite easy. I rate the setup process a nine on a scale where one is difficult, and ten is easy. We have deployed the solution on the cloud. Deploying on-premises can be time-consuming since it must be managed on servers. Also, the deployment process just takes one or two days to activate the service. Then the rest of the deployment takes a week, depending on the organization's size. We always have a team of people involved in deployment for different regions. For example, to deploy in a company in India, we have a team. For the Philippines, there is a separate team. Hong Kong also has a different team.

I rate the solution's pricing a five out of ten since it is a very highly-priced solution.

I would recommend the solution to those planning to use it. I rate the overall solution a nine out of ten.

We rely on SentinelOne to provide protection to our workers, and it is our primary means of protection besides testing. We have been using SentinelOne for some time and decided to use it exclusively with the SOC account advice. We believe SentinelOne is a comprehensive solution for protecting SOAP-based web services and AWS-based cloud infrastructure.

We use it in conjunction with other products to protect other assets, such as the cloud and network.

We had some difficulty integrating it initially, but we found the ability to receive messages and make quick decisions based on the information to be the most useful feature.

The update process has room for improvement because customers may be temporarily without protection during a software update, resulting in issues with stable performance.

I have been using this solution for six years.

Occasionally during an update, customers may temporarily be without protection until the upgrade is complete. We are actively working with another team to resolve this issue. I have a lot of customers. It's not a wonderful situation, but it can happen and customers are without protection for a while.

I would rate the scalability a ten out of ten.

We have deployed SentinelOne on-premises to secure our network, while for about 45% of our requirements, we rely on the cloud.

The license model is good. It costs a little bit more than other antiviruses. But we send the software for review. So the pricing of the products may be less, but it doesn't make sense to start with a solution without trying it.

Overall, I would rate SentinelOne Vigilance a ten out of ten.